Privacy policy

1. What data may be processed

Depending on how you contact us, identification and contact data, the content of your enquiry and information you voluntarily provide to request an assessment may be processed. If you send scalp photographs or information about your hair condition or relevant background for assessing treatment, that information will be processed solely for that purpose.

2. Purposes and legal bases

• Handling enquiries and assessment requests: to respond to requests made by the data subject and, where appropriate, take pre-contractual steps at their request.
• Managing appointments and the professional relationship: when a service is agreed, to manage the contractual relationship, necessary communications and associated administrative or legal obligations.
• Photographs or particularly sensitive information voluntarily sent for an assessment: they will be used exclusively to assess suitability and plan the requested service. Where the information may reveal health-related data, processing will be based on the data subject's explicit consent, which may be withdrawn at any time without affecting the lawfulness of prior processing.

No automated decisions are made and no profiling with legal effects on users is carried out.

3. Required data

On the contact form, fields marked as required are necessary in order to respond. It is recommended not to include medical or particularly sensitive information that is not necessary for the enquiry.

4. Retention

Data will be retained for as long as necessary to deal with the enquiry or provide the service. If an enquiry does not lead to a professional relationship, it may be retained for up to 12 months to manage possible subsequent communications. Where a professional relationship exists, certain data may be kept blocked for the periods required by tax, accounting, liability and other applicable legal obligations.

5. Recipients and providers

Personal data is not sold or shared with third parties for commercial purposes. Certain providers that supply necessary services may access data under the corresponding confidentiality and data-protection obligations.

The website form uses EmailJS to manage message delivery. EmailJS acts as a data processor and may carry out international processing or transfers, including transfers to the United States, applying the safeguards indicated in its data processing agreement, including standard contractual clauses where applicable.

If you contact us through WhatsApp, processing carried out by that service is also governed by Meta/WhatsApp's terms and policies, as it is an external service chosen by the user.

6. Rights

You may request access to your data, rectification or erasure, restriction of processing, object where applicable and request portability in the cases provided by law. You may also withdraw consent previously given.

To exercise these rights, write to capilartbcn@gmail.com, stating which right you wish to exercise and providing, only where necessary to verify your identity, sufficient information to identify you.

If you believe the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Security

Reasonable technical and organisational measures are applied to protect data against loss, unauthorised access, alteration or improper disclosure, taking into account the nature of the information processed and the existing risks.

8. Minors

The services offered are not specifically directed at minors through the website. If a minor needs an assessment or treatment, their legal representative must be involved where required by applicable law.

9. Changes to this policy

This policy may be updated to reflect legal or technical changes. The current version will be the one published on this page.

Last updated: 30 August 2026.